A Headers Checker That Also Writes the Fix
Most header scanners stop at the grade. This one puts the exact line to send under every finding, and the generator next door turns the whole set into a block for your server. The grade is a means, not the point.
What the Grade Is Made Of
Seven checks weighted by how much damage their absence allows, rolled into a grade from A+ to F. A page on plain HTTP is an F regardless, because every other header is advisory until the transport is encrypted.
- Content-Security-PolicyWorth the most: it decides what an injected script can do. A policy with
'unsafe-inline'in script-src earns much less than a strict one. - Strict-Transport-Securitymax-age, includeSubDomains and whether preload would actually be accepted.
- X-Content-Type-OptionsMust say nosniff.
- FramingSatisfied by CSP frame-ancestors or X-Frame-Options.
- Referrer-PolicyGraded by how much it leaks.
- Permissions-Policy and cross-origin isolationPermissions-Policy plus COOP, COEP and CORP round it out; version disclosure in Server or X-Powered-By costs points.
Every card carries the line to copy. The headers guide explains each one with its trade-offs, and the generator writes a complete set as an .htaccess block, an nginx block, a Caddyfile block or a Cloudflare rule.
How One Fetch Becomes a Grade
Enter a URL and securityheaders.tools fetches it once from this server, following redirects, and grades the headers on the final response. Seven checks carry weight: Content-Security-Policy (30 points, parsed directive by directive so that 'unsafe-inline' in script-src, wildcards, a missing object-src or base-uri each cost something), Strict-Transport-Security (20: max-age, includeSubDomains, whether preload would be accepted), X-Content-Type-Options (10), framing through frame-ancestors or X-Frame-Options (10), Referrer-Policy (10, graded by how much it leaks), Permissions-Policy (8) and the three cross-origin isolation headers (6). Version disclosure and obsolete headers deduct from a final 6. The percentage becomes a letter from A+ to F, and a page on plain HTTP is an F whatever else it sends, because nothing above protects anyone over an unencrypted connection.
Every card in the report shows the header as received, what it does, and the issues found, each with the value to send instead. Cookies set by the response are checked for Secure, HttpOnly and SameSite as a bonus. The generator is a separate page: tick headers, build the CSP source by source, and copy the result as an .htaccess block, an nginx block, a Caddyfile block, a Cloudflare transform rule, a Netlify _headers file or a vercel.json entry. It runs entirely in your browser.
What the grade does not know
A CDN, a WAF or a login wall can serve different headers to different visitors, and the check shows what an anonymous visitor from this server gets. A CSP that looks strict may still be bypassable through a host it allows (a public CDN full of old libraries, a JSONP endpoint), and the checker notes the common cases but cannot prove a policy airtight. Headers on the HTML page are graded; headers on scripts, images and API responses are not fetched. A good grade means the headers are present and sensibly set, not that the application behind them is secure.
When a grade looks wrong
The contact page says what to send. The report page carries the URL in its address, so a report can be shared by copying the link.